Szedd Magad – Privacy Policy

Last updated: 2026-07-31

Szedd Magad is the companion app for the Nagy Család Gyümölcsöse pick-your-own fruit orchard in Győrszentiván, Hungary. It shows opening hours, what fruit is ripe, prices and directions, and it lets you book a visit day, place a pre-order, and keep a loyalty card.

This policy explains exactly what data the app handles, why, and for how long. Where this policy says “we”, that means the orchard as data controller.

Controller

Nagy Család Gyümölcsöse, Győrszentiván, Hungary. Contact for any privacy question or request: lexandro2000@gmail.com

No account, no registration

The app does not offer or require a user account, sign-in, or password. You can browse everything — opening hours, the ripening calendar, prices, the estate map, practical information — without giving us anything at all.

What we collect, and only when you ask us to

We ask for personal data in exactly two places: when you book a visit day, and when you place a pre-order. Nothing else in the app collects personal data.

Data	Why we need it
Your name	So the orchard knows who to expect, and can identify you at the gate
Your phone number	So the orchard can call you if it closes because of rain, if a day fills up, or if there is any misunderstanding about your order
Chosen day and party size, or pre-ordered items and pickup day	This is the booking or the order itself
A random cancellation secret	So you can cancel without an account. It is stored with your booking and on your device

We deliberately do not ask for: email address, postal address, date of birth, or any payment details. You pay in cash or by card at the gate, so no payment data is created in the app at all.

Legal basis

Performance of a contract (GDPR Art. 6(1)(b)) for taking and fulfilling your booking or pre-order. Without a name and a phone number the orchard cannot deliver the service you asked for.
Legitimate interest (Art. 6(1)(f)) for keeping the record after your visit, so that a later dispute (a missed pickup, a disagreement about what was ordered) can be clarified within the statutory limitation period.
Legitimate interest (Art. 6(1)(f)) for a per-IP request counter that protects the booking endpoint from abuse. It is kept for at most one hour.

There is no marketing, no profiling, no automated decision-making, and no advertising in this app.

How long we keep it

Data	Retention
Booking or pre-order	5 years from the day of the visit, then automatically and irreversibly deleted
A booking you cancelled	30 days from cancellation, then deleted
Abuse-protection counter	1 hour

The 5-year figure matches the general limitation period under Hungarian civil law (Ptk. 6:22. §), which is the period during which a claim arising from the booking could still be raised. GDPR itself does not set a fixed maximum; it requires that we keep data no longer than necessary, and this is the necessity we rely on.

Deletion is performed by the server automatically. Note that it is traffic-driven rather than scheduled: the cleanup runs when the orchard opens its booking list, which happens daily during the season.

Data stored only on your device

The following never leaves your phone, and we never see it:

Your loyalty card number and stamp count
Which fruits you asked to be notified about
The cached orchard content (opening hours, varieties, prices, places) downloaded for offline use
Your name and phone number, remembered so the booking form can fill itself in next time

That last point is worth spelling out: the reason a returning visitor does not have to retype anything is your device remembering it, not us keeping a customer database. Uninstalling the app removes all of it.

Your rights, and how to use them

Right	How
Erasure (Art. 17)	Tap Foglalás lemondása on the confirmation screen, or remove the pre-order from the list. This deletes it on the server — no account, no email needed. See Account & Data Deletion.
Information (Art. 13)	The booking form states what we ask for and why, before you send anything.
Access, rectification, restriction, objection, portability	Email lexandro2000@gmail.com. As there is no account, we identify your record by your phone number and, if you have it, the booking ID shown on the confirmation screen.
Complaint	You may lodge a complaint with the Hungarian supervisory authority (NAIH, naih.hu).

Who else touches the data

Who	What they do	Where
Cloudflare, Inc.	Processor: runs the server functions and stores the database	The database region is EEUR (central/eastern Europe), so the data stays in the EU
Open-Meteo	Weather forecast for the orchard gate	Receives no personal data: the request contains a fixed coordinate, not your position
Google Play	App distribution	Google’s own privacy policy applies to the store itself
The orchard’s own staff app	Shows the orchard your booking so they know who is coming	Same controller, same server, no third party involved. See the Szedd Magad Gazda policy

We do not sell, rent, or share your data with anyone for their own purposes, and we do not transfer it outside the EU.

Security

All traffic uses HTTPS.
Bookings are not publicly readable. The endpoint that returns names and phone numbers requires a signed token, issued only after a named staff member signs in with a username and password on the orchard’s own staff app.
The content endpoint the app calls on every launch returns only a per-day total (how many bookings, how many people). It never returns a name or a phone number, and the totals cannot be traced back to an individual.
Staff passwords are stored as salted hashes, and the token signing key is a server secret. Neither is ever in this app.

No location, and no staff section

This app never asks for your location, and it does not request a single sensitive Android permission. The only permission it declares is internet access.

Earlier versions contained a password-protected section the orchard owner used for editing. Since July 2026 that is a separate application (“Szedd Magad Gazda”), distributed only to orchard staff — so nothing in this app can read your position or show anyone else’s data. Its own policy is here.

No analytics, no ads, no tracking

The app contains no analytics, advertising, or tracking SDKs of any kind, and does not use an advertising identifier.

Notifications

You can mark fruits you would like to be notified about. In this version that preference is stored on your device only and no notifications are sent. If push notifications are added later, this policy will be updated before that feature ships.

External links

The app opens some things in other applications: a phone number in your dialler, and directions in your map application. Once you leave the app, the privacy policies of those services apply.

Children

The app is not directed at children. Its declared target audience is 18 and over. A booking may of course cover a family, but we ask only for the booking adult’s name and phone number, and never for any information about children.

Changes to this policy

If a future version processes data differently — for example if push notifications are introduced — this page will be updated before that version is released. The date at the top always reflects the current version.

Contact

Questions about this policy, or any request about your data: lexandro2000@gmail.com